Control objectives – Why they are important
http://blog.iso27001standard.com/2012/04/10/iso-27001-control-objectives-why-are-they-important/
Let us leave aside the poor blog layout, Dejan's picture 'above the fold' taking up to much screen real estate. In actuality he's not that ego-driven.
What's important in this article is the issue of making OBJECTIVES clear and and communicating (i.e. putting them in your Statement of Objective, what ISO27K calls the SoA) and keeping them up to date.
Dejan Kosutic uses ISO27K to make the point that there are high level objectives, what might be called strategy[1], and the low level objectives[2]. Call that the tactical or the operational level. Differentiating between the two is important. They should not be confused. The high level, the POLICY OBJECTIVES should be the driver.
Yes there may be a lot of fiddly-bits of technology and the need for the geeks to operate it at the lower level. And if you don't get the lower level right to an adequate degree, you are not meeting the higher objectives.
Escalation
http://arstechnica.com/security/2012/05/google-recaptcha-brought-to-its-knees/
At one level there's the old argument about disclosure of security holes, but this is also an example of 'driving' security improvement.
Related articles
- How a trio of hackers brought Google's reCAPTCHA to its knees (arstechnica.com)
- Google's reCAPTCHA briefly cracked (h-online.com)
- How Hackers Nearly Took Down Google's ReCaptcha System (gizmodo.com.au)
- How Hackers Listened Their Way Around Google's Recaptcha (tech.slashdot.org)
- How Hackers Nearly Took Down Google's reCaptcha System (gizmodo.co.uk)
